tshark: How do I convert pcap to compressed pcapng?

tshark
pcapng
compression

asked 2018-07-16 22:20:05 +0000

gourdcaptain
1 ●1 ●1 ●1

How do I from the command line convert a standard uncompressed pcap file to a compressed pcapng file? None of the manual entries I can find explain how to do the same pcapng compression offered in the save dialogues in the GUI version of Wireshark.

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-07-17 03:39:05 +0000

Guy Harris
19890 ●3 ●659 ●207

At least on a system with a gzip command, you can do it with

editcap -F pcapng {pcap file} - | gzip >{gzipped pcapng file}

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-07-16 22:20:05 +0000

Seen: 2,404 times

Last updated: Jul 17 '18

tshark: How do I convert pcap to compressed pcapng? edit

1 Answer